Download PDF - IBM Redbooks

only in configuration files. Before you can define the AT-TLS policies, you must configure
basic operational characteristics of the policy agent in the main configuration file. The main
configuration file can contain the following statements:
TcpImage Specifies a TCP/IP image and its associated image-specific
configuration file.
LogLevel Used to define the amount of information to be logged by the policies
agent. The default value is to log only event, error, console, and
warning messages.
CommonTTLSConfig statement: The main configuration file can optionally contain a
CommonTTLSConfig statement that identifies a shared AT-TLS policy file for all the TCP/IP
stacks in your environment.
Example 8-20 shows a configuration file to start the policy agent.
Example 8-20 The pagent.sc59.conf file to start the policy agent
LogLevel 15
TcpImage TCPIP flush purge 1
TTLSconfig /etc/sc59.ttls.Server.policy flush purge
Before starting the PAGENT policy agent, restrict unauthorized access to the UNIX pasearch
command. With this command, you see policy definitions and verify that policies are correctly
defined. However, in some instances, not every user is permitted to read the policy
definitions. To restrict unauthorized access to the pasearch command, a profile is defined to
the RACF resource class, called SERVAUTH. The profile name can be defined by the TCP/IP
stack (TcpImage) and policy type (ptype = QoS, IDS, IPSec, or TTLS).
The use of wildcards in profile names is allowed as shown in bold in Example 8-21.
Example 8-21 RACF commands to restrict unauthorized access to the UNIX pasearch command
//PAGNACC EXEC PGM=IKJEFT01
//SYSTSPRT DD SYSOUT=*
//SYSTSIN DD *
RDEFINE SERVAUTH EZB.PAGENT.SC59.TCPIP.* UACC(NONE)
PERMIT EZB.PAGENT.SC59.TCPIP.* CLASS(SERVAUTH) -
ID(MAXIM) ACCESS(READ)
PERMIT EZB.PAGENT.SC59.TCPIP.* CLASS(SERVAUTH) -
ID(OLIVER) ACCESS(READ)
SETROPTS GENERIC(SERVAUTH) REFRESH
SETROPTS RACLIST(SERVAUTH) REFRESH
/*
Defining and installing AT-TLS policies
An AT-TLS policy configuration file contains AT-TLS rules that define a set of conditions that
are compared to connections when a policy is mapped during a connection. If a rule match is
found, AT-TLS transparently provides TLS protocol control for the connection based on the
security attributes that are specified in the actions associated with the rule. An AT-TLS rule is
defined with the TTLSRule statement, which specifies a set of conditions that are compared
with the connection that is being verified by TCP/IP.
Chapter 8. Security enhancements of DB2 10 for SAP solutions 129